r3nor/mullvad-tailscale

Use Mullvad VPN along with Tailscale and/or Zerotier

Mullvad with Tailscale / Zerotier

Mullvad Nftables script

Note: The script was formerly called mtc. It is now mnf and has been improved.

This is a simple bash script that will allow you to run Mullvad VPN along with Tailscale or Zerotier on Linux.

mnf (for Mullvad nftables) was inspired by this gist, although it has been completely rewritten and improved.

This script works with Zerotier and Tailscale.

Features

• Bring up Tailscale/Zerotier and Mullvad with a random server
• Connect to a specific country
• Blacklist countries to avoid connecting to them
• Use only RAM-only (diskless) servers
• Set custom DNS server(s) for Mullvad
• Bring down all (tailscale/zerotier+mullvad+nftables) or each one selectively
• Automatically update the Mullvad relay list at startup
• and more.

Requirements

• Mullvad must be installed on your system, so that the mullvad cli command is available.
• Install the nftables package.
• tailscale or zerotier-one must be installed and configured properly.

Setup

1. Clone this repo:

git clone https://github.com/r3nor/mullvad-tailscale

Or download and extract the latest release source from releases page.

2. Go to the cloned dir: cd mullvad-tailscale
3. Make the script executable:

chmod +x mnf

4. Inspect and edit the script file (mnf):

• Change the RULES_DIR variable to point to the directory in which the mullvad.rules file from this repository is located. If you cloned the repo, it should be inside the mullvad-tailscale folder.
• Modify the EXCLUDE_COUNTRY_CODES variable if you want to exclude any countries from the VPN connection (don't connect to these countries). If you do not want to exclude any country, set this variable to ''. If you want to add more, just add most two-letter country codes, separated by spaces.
• Uncomment the INCLUDE_COUNTRY_CODES variable if you want to force the connection to specific countries (only connect to these countries). This will override EXCLUDE_COUNTRY_CODES. If you want to add more, just add most two-letter country codes, separated by spaces.

5. Edit the mullvad.rules file:

• Set your Tailscale/Zerotier network IPs in the EXCLUDED_IPS variable (you can use CDIR notation).
• Set your Tailscale/Zerotier network IPv6 IPs in the EXCLUDED_IPV6 variable (you can use CDIR notation). If you do not want IPv6 support, comment this line as well as the one starting with ip6 daddr $EXCLUDED_IPV6 .
• Set your Tailscale/Zerotier DNS resolver in RESOLVER_ADDRS.
  • It should be 100.100.100.100 for Tailscale.
  • If you are using Zerotier, the DNS resolver IP can be found in the /etc/resolv.conf file after running zerotier-one service. You will find it in a new line. It should look like 10.X.X.X.

You can find the Tailscale/Zerotier IPs in your dashboard. Just use copy and paste for each of your devices.

6. Setup your Mullvad account if you haven't done it yet:

mullvad account login 1234123412341234

Usage

You might want to add mnf to your PATH. Jump to an example usage

up

Apply nftables configuration and connect to Mullvad and Tailscale/Zerotier.

mnf up [-OPTIONS]:
    -h | --help         Show this help message
    -r | --ram          No-disk/RAM only Mullvad relays (default: all servers)
    -z | --zerotier     Use Zerotier instead of Tailscale
    -d | --dns          Set custom Mullvad DNS server (i.e. -d 1.1.1.1 or -d 8.8.8.8,1.1.1.1)
    -c | --country      Specify country code(s) to connect to (i.e. -c gb or -c fr,pt,es)
    -f | --file         Specify a particular NFT rules file (default: mullvad.rules)

down

Bring down Mullvad and remove nftables configuration.

mnf down [-OPTIONS]:
    -h | --help         Show this help message
    -a | --all          Stop Mullvad and Tailscale/Zerotier (default: only stop Mullvad)
    -z | --zerotier     Use Zerotier instead of Tailscale
    -t | --table        Indicate the nft tablename to bring down (default: mullvad-ts)

conf

Apply nftables configuration so Mullvad and Tailscale/Zerotier can work together and do nothing more.

mnf conf [-OPTIONS]:
    -u                  Remove the nftables configuration
    -h                  Show this help message

Example

mnf up -rz -d 1.1.1.1 -c ee

or the same command with long flag names:

mnf up --ram --zerotier --dns 1.1.1.1 --country ee

This connects to Mullvad's RAM-only servers (-r) in Estonia (-c ee) and uses Zerotier (-z). It also sets the MullvadVPN DNS to 1.1.1.1 .

mullvad-tailscale's Issues

mullvad relay set hostname doesn't work anymore

as per 2023.5. this should fix it

diff --git a/mnf b/mnf
index e8fb764..c539d33 100755
--- a/mnf
+++ b/mnf
@@ -254,7 +254,7 @@ up() {
 
   # Connect to Mullvad
   printf "[INFO] Connecting to server '%s'...\n" "$relay"
-  prefix_output mullvad relay set hostname "$relay"
+  prefix_output mullvad relay set location "$relay"
   prefix_output mullvad connect -w
 
   if [[ "$zerotier" = true ]]; then

Can't remove table 'mullvad-ts'. Has it already been removed? Exiting.

When I run mnf up it connects to Mullvad and I can connect to the internet as usual, but I can't connect to my Tailscale devices. Here's the output of the command:

[INFO] Checking nftables rules validity...
[INFO] nftables rules are valid.
[INFO] Disconnecting tailscale...
[TAILSCALE] Tailscale was already stopped.
[INFO] Tailscale disconnected.
[INFO] Disconnecting Mullvad...
[INFO] Mullvad disconnected.
[INFO] Removing nftables config...
[NFT] Error: Could not process rule: No such file or directory
[NFT] delete table inet mullvad-ts
[NFT] ^^^^^^^^^^
[ERROR] Can't remove table 'mullvad-ts'. Has it already been removed? Exiting.
[INFO] Ignoring error...
[MULLVAD] Updating relay list in the background...
[INFO] Setting DNS server(s) for Mullvad...
[MULLVAD] Updated DNS settings
[INFO] Restarting tailscale connection...
[TAILSCALE] Tailscale was already stopped.
[INFO] Applying nft rules...
[INFO] Connecting to server 'au-per-wg-302'...
[MULLVAD] Setting location constraint to au-per-wg-302 in per, au
[MULLVAD] Relay constraints updated
[MULLVAD] Connecting to au-per-wg-302 in Perth, Australia...
[MULLVAD] Connected to au-per-wg-302 in Perth, Australia

Duplicate commands + checks?

Hi,

Thanks a lot for this very useful script.

I noticed that there were duplicate command calls:

mullvad-tailscale/mtc

Line 136 in 1784d31

sudo tailscale down

and

mullvad-tailscale/mtc

Line 139 in 1784d31

sudo tailscale down

Also, is this needed

mullvad-tailscale/mtc

Line 153 in 1784d31

mullvad connect -w

?

Thanks.

Exit Node Support

Hi, I saw your comment on tailscale/tailscale#2880. Does this script support using the node as an exit node (routing all traffic from the Tailscale network through Mullvad)?

FR: Make the script easier to run, configure and update

• Add Systemd service
• Store configuration in external file in order to make updates easier to deal with
• Generate rules file from within script so the user doesn't have to comment/edit it

How to get netfilter tables to persist between boot?

Thanks for the utility, @r3nor. This has worked very well on my end.

I don't use netfilter for any other application and rely on uft for a firewall, so it took me a few boots to realize that the mullvad-ts table created by mtc conf is wiped on reboot. In a way, it's nice to have a blank slate on boot, but if I wanted for the tables to persist, would running the following commands be all I need?

nft list ruleset > /etc/nftables.conf
systemctl enable --now nftables

Any recommendations or best practices would help. Thanks again!

Wrong nft-related instructions in README

The README says the user should "[set their] Tailscale/Zerotier network IPv6 IPs in the EXCLUDED_IPV6 variable (you can use CDIR notation), leave it blank if there are no IPv6s."

However, if the value is left blank, calling nft fails with:

Error: syntax error, unexpected newline
define EXCLUDED_IPV6 =
                      ^
mullvad-tailscale//mullvad.rules:16:16-28: Error: unknown identifier 'EXCLUDED_IPV6'; did you mean identifier ‘EXCLUDED_IPS’?
    ip6 daddr $EXCLUDED_IPV6 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;

The user should be instructed to comment out these lines instead or, even better, the rules files should be generated from within mtc.

After starting script on my local host, it disconnects from anything

Hi, I like the idea of the repo.
My goal is (example):
Smartphone/PC/... (tailsc.) --> home local server (tailsc.-exit node) --> mullvad -> internet

I've configured IPs of tailnet (included local server) and removed ipv6 flags in config.
I use ufw for other things, but I didn't touch it for this thing.
nftables already installed, and mullvad set up correctly.
I use this machine as exit node and subnet for tailscale.
When I start the script, the host disconnects and I lost all connections. I can't ssh locally, neither on tailscale.
Suggestions? Thanks in advance.

Make it work with ProtonVPN

Been testing ProtonVPN free version with the script and seems to work. I will try to make it also work with Proton-vpn instead of Mullvad